Policy return DUNNO or DEFER_IF_PERMIT